Privacy policy
Last updated: 2026-11-11.
In short
- You can learn on SQL Dojo without an account: your progress then stays in your browser and is never sent to us.
- We measure how the site is used with anonymous statistics, without cookies, hosted in the EU.
- An account (optional, needed for Pro) holds your email address and your progress, to sync it across devices.
- We never see your card: payments are handled by Stripe. We do not sell or rent any data, and there is no advertising.
Who is responsible
Maxime Lemaitre, hello@sqldojo.dev, is the data controller for the data described here (see the legal notice).
What we process, why, and for how long
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Anonymous usage events: pages and steps opened, checks passed or failed, hints used, the language; never the queries you type, never your IP address | understand what helps learners and fix what does not | our legitimate interest in improving the site | at most 3 years, without any identifier |
| Feedback you send (a 👍/👎, a comment, and your query if you tick the box) | improve the steps and the site | our legitimate interest | at most 3 years |
| Account: email address, sign-in method (email code or Google), dates of sign-up and last sign-in | let you sign in and keep your progress | the contract (the service you asked for) | until you delete the account; deleted after 3 years without any sign-in, after an email warning |
| Progress synced with the account: steps mastered, review dates, exam scores, drafts of your queries, votes on steps; and a log of each change to it (which step or exam, when) | the same progress on every device, and its history | the contract | as long as the account |
| Pro purchase: date, status (paid, refunded), the order and customer ids at Stripe, and a hash of your email (a scrambled form, which cannot be read back) | give you access to Pro, for life: if you delete your account and sign up again with the same email, Pro comes back | the contract | as long as Pro is offered, even after your account is deleted; ask us to delete it too and it goes (Stripe keeps its own record of the sale) |
| Error reports: the error, the page, the browser and system versions | find and fix bugs | our legitimate interest | 30 days |
| Emails we send you: the sign-in code, a welcome email, messages about your purchase | the service | the contract | as long as the account |
We send no newsletter and no marketing email unless you ask for it.
What stays in your browser
The site stores your progress, drafts, recent queries and settings in your browser's local storage (localStorage), so that it works and remembers where you are. This storage is needed for the service you use; we do not read it from outside, and we use no cookies for statistics or advertising. Signing in adds the session of the sign-in service (Supabase) to that storage. You can remove all of it by clearing the site's data in your browser; Export my progress (in the ⚙ menu) keeps a copy first.
Who handles data for us
| Service | What for | Where |
|---|---|---|
| Cloudflare, Inc. | hosting the site; Turnstile, which checks that a sign-in comes from a person and not a bot (no tracking cookie) | worldwide network; United States |
| jsDelivr (CDN) | delivering the SQL engine to your browser (it sees your IP address, as any website you load files from) | worldwide |
| PostHog, Inc. (EU Cloud) | anonymous usage statistics | European Union (Frankfurt) |
| Supabase, Inc. | accounts and synced progress | European Union (Frankfurt) |
| Resend, Inc. | sending the sign-in and account emails | United States |
| Google Ireland Ltd. | "Continue with Google", only if you choose it | European Union, United States |
| Functional Software, Inc. (Sentry) | error reports | European Union |
| Stripe, through its Link service | selling Pro as merchant of record: payment, receipts, taxes. It decides how it uses your payment data, under its own privacy policy | European Union, United States |
Transfers outside the European Union rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
Your rights
You can ask to access, correct, delete or receive your data, object to its use, or limit it. From the site itself: Export my progress (Download my data once signed in) gives you your progress, and Delete my account (⚙ menu, once signed in) deletes your account and its data at once. For anything else, write to hello@sqldojo.dev: we answer within a month. You can also complain to the CNIL (cnil.fr), the French data protection authority, or to the one of your country.
Changes
If this policy changes in a way that matters, we will say so on the site, and by email to account holders, before it applies.